Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'XpertRAT' = '%WINDIR%\XpertRAT\Server.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RUNSERVICES] 'Server' = '%WINDIR%\XpertRAT\Server.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{A3M0R4J1-U5K5-Q1L0-P8X1-H0V2K1E6G8X2}] 'StubPath' = '%WINDIR%\XpertRAT\Server.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\XpertRAT\Server.exe' = '%WINDIR%\XpertRAT\Server.exe:*:Enabled:Server'
- Средство контроля пользовательских учетных записей (UAC)
- %WINDIR%\XpertRAT\Server.exe
- %WINDIR%\XpertRAT\Server.exe
- %WINDIR%\XpertRAT\Server.exe
- '10#.#85.204.70':5151
- ClassName: 'Indicator' WindowName: ''